Full Disclosure - Controversy

Controversy

Full disclosure can be controversial, as often these disclosures include code or executable tools to exploit the vulnerability. The argument against disclosure is that providing complete details or tools to malicious attackers, such as black hats and script kiddies, allows them to take advantage of vulnerabilities more quickly and makes attacks more widespread. However, this argument assumes that without disclosure such tools and attacks would not have occurred. The advantage of disclosure is that white hats will obtain the information, and that the vulnerability will be detected and patched more quickly.

n3td3v was banned from the Full disclosure mailing list on January 21 2009. n3td3v is thought to be banned in response to his widespread criticism of what he saw as irresponsible disclosure practices carried out by some security researchers, such as HD Moore. Some saw the banning of n3td3v as an attack on freedom of speech in an email post to the list August 31 2009, while others accuse him of being an internet troll.

In August 2010, HD Moore found about 40 vulnerabilities related to DLL load hijacking in Windows applications that Rapid7 was going to publish under its vulnerability disclosure policy. Arcos, a Slovenian security firm, found one related vulnerability for iTunes and decided to publish without alerting the vendor, saying "it hasn’t paid out well" in the past and "we’ve found better markets for this kind of information".